HR & DRHuman Resources and Disaster Recovery

11/6/2008Cynthia A. Donovan

510-339-6315 or 562-346-2291donovan_c@sbcgobal.net or cdonovan@calstate.edu

Nov.6, 2008 2

• What is Business Continuity Planning (a.k.a BCP, DR, COOP/COG, etc.)?

• HR roles?– Anticipating employee issues.– Creating HR’s business continuity plan.– Interfacing with partner organizations.

• BCP – HR interactions at the CO.

Agenda

Nov.6, 2008 3

EO 1014 mandates BCP at CSU:• “to maintain an ongoing program on each

campus that ensures the continuity of essential functions or operations following a catastrophic event. …. As required by the state of California Executive Order S-04-06, all state agencies shall update their COOP/COG* plans consistent with these guidelines.”

* Continuity of Operations/Continuity of Government (COOP/COG)

Nov.6, 2008 4

In June of 2008 alone…• Tornado: Kansas State University, 6/12/08

– …hundreds of college students seeking shelter from the tornado that swept through K-State Wednesday night …

– …people who didn't have power this morning wouldn't know whether to go to school or not.

– … damaged the building housing a nuclear research reactor.

• Fire: Butte College (Humboldt county): 6/13/08– Classes were closed at the main campus. – More than 700 firefighters had made the

campus their temporary home. • Flooding: University of Iowa, 6/20/08

– …cancellation of classes … and the evacuation of nearly 200 patients at Mercy Medical Center.

– Twenty buildings in all were damaged on campus, $232 million damage, only $71.6 covered by FEMA.

– U of I Arts campus closed for year.• Hazardous Material Spill: UC Davis, 6/23/08

Nov.6, 2008 5

And don’t forget:• Earthquakes• Pandemic Flu• Power outages• Data Center failures

– Hardware/software– Network– Human error

• Even the plumbing….

Nov.6, 2008 6

Human Resource Department’s Roles?– Anticipating employee issues.– Creating HR’s business continuity plan.– Interfacing with partners’ BCPs.

Nov.6, 2008 7

Anticipating Employee Issues: Represented and non-represented.• Pay policy:

– For those asked not to report to work.– For those who failed to report when called.– For those expected to report (e.g. Extra pay?)– Work reassignments. – Hazardous work.– Vacation pay.– Extraordinary expense reimbursements (phone, travel, shelter, etc.) – Time reporting (FEMA claims require daily reports).

• Job descriptions and hiring policy:– Inclusion of BCP responsibilities in job descriptions.– Policy exceptions for bringing on supplemental staff quickly.

• Management of volunteer forces (employee and community).

Nov.6, 2008 8

Anticipating Employee Issues–continued. Represented and non-represented.• Confidentiality:

– Distribution of emergency contact information.– Disabilities and medical information.– Employee tracking as they move.– Enquiries on employee/student status.

• Counseling and out-reach:– Manager roles and training (pre and post incident).– Employee Assistance Programs.– Resource matching: web sites, swap sites, CSU sponsored aid, etc.– Grieving, tributes, donations, healing.

• Long term consequences: i.e. records of exposure to hazardous materials.

Nov.6, 2008 9

Human Resource Department’s Roles?– Anticipating employee issues.– Creating HR’s business continuity plan.– Interfacing with partners’ BCPs.

Nov.6, 2008 10

BCP is a continuing process: Dimensions defined in EO 1014

• Risk Assessment • Business Impact Analysis• Business Continuity Plan (doc)• Training, Testing and Exercising Plans• Maintenance

• Communication• Record Retention*

* Per EO 1014: “for a period of not less than five years”.

Analyze

PlanTest

Maintain

Nov.6, 2008 11

Business Impact Analysis• Establish which functions to recover.

– Define functions and dependencies– Prioritize by impact + speed (i.e. “essential”).

• Impacts: qualitative and quantitative• Speed:

– Establish function recovery speed– Establish recovery point in time

– Improve resilience of functions (optional).

Nov.6, 2008 12

Example: List functions, dependencies and recovery time.

Function Critical Function Description Relationship to Other Organizations(If you need more space please attach a separate page and reference Table 1.1)

Maximum Down Time (Less than 3 days, 3 days, 1 week or 1 Month):

1 Paying employees monthly Serve all groups in the enterprise, Internal data center and State Controllers Office

Less than 3 days

2 Administration of leave programs (sick, FML, NDI, cat, etc.)

Serve all groups in the enterprise, State Controllers Office

1 week

3 Evaluating/processing changes in pay Serve all groups in the enterprise, State Controllers Office

1 month

4 …etc….

Nov.6, 2008 13

Essential functions are identified by size and speed of impact:• What can wait?• What must I do first?

– Impact size– Impact timing

Nov.6, 2008 14

What must I do first? Quantitative Analysis

ImpactSize

Function 1 $1,000,000

Function 2 $500,000

Function 3 $250,000

Nov.6, 2008 15

What must I do first? Quantitative Analysis

ImpactSize

Impact Timing

Function 1 $1,000,000 14 days

Function 2 $500,000 7 days

Function 3 $250,000 2 days

Nov.6, 2008 16

What must I do first? Qualitative Impacts• Examples

– Regulation– Reputational risk– Subjective estimates: Admission delays, etc.

• One approach:– Functional experts suggest recovery priority. – Executive teams normalize priorities across

organizations.

Nov.6, 2008 17

A “recovery point” in time? Tolerance for data/productivity loss

Work Continuesbut not recorded.

Catch-up Work and Continue.

Recovery Time

Work suspended.

Recovery Point

Nov.6, 2008 18

Improve resilience:• Eliminate single points of failure.

– Dual training.– Redundancy built into supporting technology.– Split work between multiple work sites.– Maintain manual options, if practical. – Move data off-site frequently.

• Create time and inventory buffers.

Nov.6, 2008 19

Use the BIA to:• Create the baseline for all subsequent planning.• Set restoration priorities.• Search out risk mitigation opportunities.

Nov.6, 2008 20

HR Business Continuity Plan Document: EO 1014 outline.

• BCP organization framework and definitions. • Risk Assessment.• Prioritized list (by recovery time) of essential functions.• Lines of Succession/Delegation of Authority:• Alternate Operating Plans:• Communications to:

– internal personnel, – other agencies, and – emergency personnel.

• Protection and safeguarding of vital records and databases.• Tests, Training, and Exercises Schedule

Nov.6, 2008 21

Lines of Succession – suggest 3 deep.Title Key Position Designees

HR: Senior Director M. Davidson 1) First Designee2) Second Designee3) Third Designee

HR Operations: Director S. James 1. B. Frank2. M. George3. J. Cain

HR Benefits: Manager B. Clark 1. G. Dunne2. J. Samson3. M. Troth

…

Nov.6, 2008 22

“Alternate Operation”?• What changes from “normal” processing?• What resources do I need?

– People/teams– Technology– Vital records

• What permissions are needed in advance for non-standard operations?

• Plan activation: – Who activates and how?– How do I contact team members?

• Communication: – Who needs to be informed and when?

Nov.6, 2008 23

Summary: BCP Document• Mandated.• Documents what will be done and why.• Training and communications tool.• Exercise it!

Nov.6, 2008 24

Human Resource Department’s Roles?– Anticipating employee issues.– Creating HR’s business continuity plan.– Interfacing with partners’ BCPs.

Nov.6, 2008 25

Support of partners’ BCPs• Executive/Emergency Operational Team memberships.• HR recovery procedures used by others:

– Payroll/benefits processing– Emergency “hiring”– Time reporting for insurance/FEMA claims

• Memorandums of Understanding.– Payroll processing

Nov.6, 2008 26

Q&A:

Nov.6, 2008 27

Summary:• Business Continuity Planning is mandated.• Human Resources teams contribute by:

– Anticipating employee issues.– Creating a BCP for the HR team.– Supporting partners’ BCPs.

www.calstate.edu